Multiple http filters

We've multiple conf files which have http filters in them. And they are running simultaneously at a time. Running multiple http filters at a time seems to give us problems. Please help us to understand if its the behavior of Logstash that it cannot run multiple http filter conf files at a time or we need to improve it?


There are 3 conf files which are making http requests separately every 5 minutes. On seeing the logs, we have seen if any of these files run at a same time then only one call processes and other gives error.

We also see below error log at the end of log file, after this Logstash starts again automatically.

Have pasted the error log below:

[2020-04-02T06:01:00,576][WARN ][logstash.inputs.udp ] UDP listener died {:exception=>java.nio.channels.ClosedSelectorException, :backtrace=>["", "", "", "", "", "org.jruby.RubyIO$INVOKER$s$0$3$$INVOKER$s$0$3$select.gen)", "org.jruby.internal.runtime.methods.JavaMethod$", "org.jruby.runtime.callsite.CachingCallSite.callBlock(", "", "", "", "", "", "org.jruby.internal.runtime.methods.MixedModeIRMethod.INTERPRET_METHOD(", "", "", "", "", "", "org.jruby.internal.runtime.methods.MixedModeIRMethod.INTERPRET_METHOD(", "", "", "amp.logstash.logstash_minus_6_dot_3_dot_0.logstash_minus_core.lib.logstash.pipeline.RUBY$method$inputworker$0(/amp/logstash/logstash-6.3.0/logstash-core/lib/logstash/pipeline.rb:512)", "amp.logstash.logstash_minus_6_dot_3_dot_0.logstash_minus_core.lib.logstash.pipeline.RUBY$method$inputworker$0$VARARGS(/amp/logstash/logstash-6.3.0/logstash-core/lib/logstash/pipeline.rb)", "", "", "", "amp.logstash.logstash_minus_6_dot_3_dot_0.logstash_minus_core.lib.logstash.pipeline.RUBY$block$start_input$1(/amp/logstash/logstash-6.3.0/logstash-core/lib/logstash/pipeline.rb:505)", "org.jruby.runtime.CompiledIRBlockBody.callDirect(", "", "", "", "", "", ""]}
[2020-04-02T06:01:00,607][ERROR][org.logstash.Logstash ] java.lang.OutOfMemoryError: Java heap space

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.